Allow 0-RTT for Resumed Sessions Versus Require 1-RTT (No Early Data)
TradeoffNetworking & OSSeniorStaffUpdated
Returning clients are hitting your API. Do you allow TLS 1.3 0-RTT or require a full 1-RTT handshake?
Short answer: Require 1-RTT (no early data). 0-RTT early data is replayable by an attacker that captures it.
The Two Options
A
Allow 0-RTT for resumed sessions
B
Require 1-RTT (no early data)
Drill This: Your Pick First
The Better Pick
Option B
Require 1-RTT (no early data)
0-RTT early data is replayable by an attacker that captures it. For mutations, payments, or anything non-idempotent, that is unsafe. The 1 extra round trip is worth the safety.
When the Other One Wins
Allow 0-RTT for resumed sessions
For idempotent GETs on a latency-critical read path (search, feed, static APIs), enable 0-RTT and bound the replay window with an anti-replay cache.